import requests
import pprint
headers = {'Host': '192.168.1.100:9200',
           'Content-Type': 'application/json'}


# 创建索引
def search_all(index_name):
    doc_json = {
                  "query": {
                    "match_all": {}
                  }
                }
    r = requests.post('http://192.168.1.100:9200/' + index_name + '/pkts/_search', headers=headers, json=doc_json)
    pprint.pprint(r.json(), indent=4)


# group by src
def group_by_src(index_name):
    doc_json = {
                  "size": 0,
                  "aggs":   {
                            "agg": {
                                        "terms":    {
                                                    "field": "ip_src_host.keyword",
                                                    },
                                    }
                            }
                }
    r = requests.get('http://192.168.1.100:9200/' + index_name + '/pkts/_search', headers=headers, json=doc_json)
    pprint.pprint(r.json(), indent=4)


# search src
def search_src(index_name, src):
    doc_json = {
                  "size": 1000,  # 返回数量
                  # 返回内容
                  "_source": {"includes": ["ip_src_host", "ip_dst_host"]},
                  # 查询单个条目
                  "query":   {

                                "term":    {
                                            "ip_src_host": src,
                                            },

                            }
                }
    r = requests.get('http://192.168.1.100:9200/' + index_name + '/pkts/_search', headers=headers, json=doc_json)
    pprint.pprint(r.json(), indent=4)


# search src dst
def search_src_dst(index_name, src, dst):
    doc_json = {
                  "size": 1000,  # 返回数量
                  # 返回内容
                  "_source": ["ip_src_host",
                              "ip_dst_host",
                              "tcp_srcport",
                              "tcp_dstport"],
                  # 查询多个条目
                  "query":   {
                                "bool": {
                                            "must": [
                                                {"term": {
                                                           "ip_src_host": src,
                                                         }},
                                                {"term": {
                                                            "ip_dst_host": dst,
                                                }},
                                            ],
                                            "must_not": [
                                                {"term": {
                                                    "tcp_srcport": '49985',
                                                }},
                                            ]
                                }
                            }
                }
    r = requests.get('http://192.168.1.100:9200/' + index_name + '/pkts/_search', headers=headers, json=doc_json)
    pprint.pprint(r.json(), indent=4)


# group by src and dst
def group_by_conn(index_name):
    doc_json = {
                  "size": 0,
                  "aggs":   {
                            "agg1": {
                                        "terms":    {
                                                    "field": "ip_src_host.keyword",
                                                    },
                                        'aggs': {
                                                    "agg2":     {
                                                                    "terms":    {
                                                                                "field":  "ip_dst_host.keyword",
                                                                                }
                                                                }
                                                }
                                    }
                            }
                }
    r = requests.get('http://192.168.1.100:9200/' + index_name + '/pkts/_search', headers=headers, json=doc_json)
    pprint.pprint(r.json(), indent=4)


if __name__ == "__main__":
    # search_all('pyshark')
    # group_by_src('pyshark')
    # search_src('pyshark', '192.168.1.200')
    search_src_dst('pyshark', '192.168.1.200', '58.211.137.227')
    # group_by_conn('pyshark')
